dsh-drill-script-check 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+## 0.2.2
+
+- Rework the README first screen. The H1 now names what the plugin checks rather
+  than repeating the package name, and a question-and-answer table and a standards
+  table come before the boundary paragraph.
+
+  The substance is unchanged and the boundary paragraph is verbatim: in a
+  compliance tool that paragraph is what stops a wrong "pass" being read as
+  approval, so it moved rather than shrank. What changed is the order - a reader
+  or an extractor previously met eleven badges, an install command and a
+  disclaimer before learning what the plugin does. The Q&A rows are derived from
+  each plugin's own rules and the standards table from the rule pack's
+  `document`/`number` fields, so no answer and no standard is hand-typed.
+
+  All five languages were restructured together; `check:readmes` holds them to the
+  same section count, install command and configuration keys.
+
+## 0.2.1
+
+- Ship `CHANGELOG.md` and `SECURITY.md` inside the package. `files` is an
+  allowlist and neither was on it, so no release note had ever reached anyone
+  who installed this package, and npm had no changelog section to show.
+## 0.2.0
+
+- Release infrastructure brought to the family standard: `verify:self-contained`,
+  `check:lockfile`, `check:readmes` and `check:citations` gates, a `prepublishOnly` that
+  re-runs the whole chain, SECURITY.md, dependabot, and the OpenSSF Scorecard workflow.
+- `check:citations` enforces the rule this pack's own header states: every `excerpt`
+  must be a verbatim quotation, findable in `rules/evidence/`. Rules that are not
+  traceable yet are listed in `rules/citations-baseline.json`, and that file can only
+  shrink - anything new has to be sourced before it can land.
+- The README install command now names the published package instead of a local tarball.
+- Five-language READMEs hold the same section count and the same configuration keys.
+- Rule pack: 8 rules across DR-001..DR-008.
+- Licensed Apache-2.0.

package/README-es.md

@@ -1,4 +1,24 @@
-# dsh-drill-script-check
+# dsh-drill-script-check — Verificación de la completitud y la aritmética de un guion de simulacro de emergencia
+
+`dsh-drill-script-check` lee un guion de simulacro de emergencia —la cabecera del simulacro más una fila por etapa— y comprueba la completitud y la aritmética de ese guion: que cada etapa registre su fase de simulacro o su contenido de guion, que nombre a un responsable de mando, que el nivel de respuesta proceda del vocabulario que usted configure, que una etapa con acción de guion enumere los recursos que necesita, que las duraciones de las etapas sumen la duración prevista del simulacro, que un punto clave declare su condición de juicio, que no se repita ningún número de etapa y que la cabecera nombre el simulacro y la entidad organizadora.
+
+## Qué responde
+
+| Usted pregunta | Qué responde |
+|---|---|
+| Una etapa no tiene rellenas ni la fase del simulacro ni el contenido del guion. ¿Se informa de ello? | Sí. `DR-001` pide juntas las columnas `phase` y `script` e informa de la etapa en la que ninguna de las dos está rellena: basta con una de ellas para pasar. Comprueba que la columna esté rellena, no si la acción es correcta o concuerda con su plan de emergencia. |
+| He rellenado el nivel de respuesta, pero `DR-003` se informa a sí misma en `skipped`. ¿Por qué? | `DR-003` compara la columna `level` con el vocabulario de `values`, que viene vacío, así que hasta que configure sus propios niveles la regla informa de que no pudo ejecutarse en lugar de pasar en silencio. Solo comprueba que el valor figure en su lista: nunca juzga qué nivel debería activar un suceso. |
+| Una etapa meramente informativa no enumera equipo. ¿Se señala? | No. `DR-004` pide la columna `resource` solo cuando el contenido `script` de esa etapa está relleno, así que a una etapa informativa no se le piden medios. Comprueba que los recursos estén enumerados, no que sean suficientes o que coincidan con lo realmente disponible. |
+| Las duraciones de las etapas no suman la duración prevista del simulacro. ¿Se detecta? | Sí. `DR-005` suma los valores de `durationMin` de las etapas y compara ese total con `totalDurationMin`, que toma de la cabecera del material: busca primero dentro de la fila y recurre a la cabecera. Es solo una comprobación de suma: no juzga si el reparto del tiempo es razonable o suficiente. |
+| ¿Qué debe contener la columna de punto clave de una etapa? | `DR-006` exige que la columna `checkpoint` —el punto clave junto con su condición de juicio— esté rellena en la etapa. Comprueba que se haya escrito algo ahí, no que la condición sea observable o adecuada. |
+| Una fase se reparte en tres filas de acción y dos de ellas llevan el mismo número de etapa. | `DR-007` informa del `stepNo` repetido, porque la repetición hace poco fiables el total de duraciones y el recuento de etapas. Repartir una fase en varias filas de acción es normal: dé a cada fila su propio número de etapa. |
+
+## Normas que sigue
+
+| Documento | Número | Reglas que lo citan |
+|---|---|---|
+| 《生产安全事故应急演练基本规范》 | YJ/T 9007—2019（原 AQ/T 9007—2019，2025 年第 1 号公告调整代号；本次未取得条文） | DR-001, DR-002, DR-004, DR-005, DR-006, DR-007, DR-008 |
+| 本单位应急预案体系（本机构配置） | 无统一标准（本条依据为本机构预案的分级口径） | DR-003 |
 
 **Boundary:** this plugin checks an **应急演练脚本** for completeness and arithmetic — that each step names its
 phase and script content, that it names a commander, that the response level comes from your vocabulary, that a

package/README-hi.md

@@ -1,4 +1,24 @@
-# dsh-drill-script-check
+# dsh-drill-script-check — आपातकालीन अभ्यास स्क्रिप्ट की पूर्णता और अंकगणित की जाँच
+
+`dsh-drill-script-check` एक आपातकालीन अभ्यास स्क्रिप्ट पढ़ता है — अभ्यास का हेडर और प्रत्येक चरण की एक पंक्ति — और उसी स्क्रिप्ट की पूर्णता तथा अंकगणित की जाँच करता है: क्या प्रत्येक चरण अपनी अभ्यास-चरण (phase) या script सामग्री दर्ज करता है, क्या वह किसी कमांडर (commander) का नाम देता है, क्या प्रतिक्रिया स्तर आपके द्वारा कॉन्फ़िगर की गई सूची से आता है, क्या script क्रिया वाला चरण अपने आवश्यक संसाधन गिनाता है, क्या चरणों की अवधियों का जोड़ अभ्यास की नियोजित अवधि के बराबर है, क्या कोई मुख्य बिंदु अपनी निर्णय-शर्त लिखता है, क्या चरण-क्रमांक दोहराए नहीं गए हैं, और क्या हेडर अभ्यास का नाम तथा आयोजक संस्था बताता है।
+
+## यह किन सवालों का जवाब देता है
+
+| आपका सवाल | इसका जवाब |
+|---|---|
+| किसी चरण में न अभ्यास-चरण भरा है और न script सामग्री। क्या यह दर्ज होता है? | हाँ। `DR-001` `phase` और `script` दोनों कॉलम एक साथ माँगता है और वह चरण दर्ज करता है जिसमें दोनों में से कोई भी नहीं भरा हो — दोनों में से एक भरा होना ही पास होने के लिए पर्याप्त है। यह देखता है कि कॉलम भरा है, यह नहीं कि क्रिया सही है या आपकी आपात योजना के अनुरूप है। |
+| मैंने प्रतिक्रिया स्तर भर दिया, पर `DR-003` स्वयं को `skipped` में दर्ज करता है। क्यों? | `DR-003` `level` कॉलम की तुलना `values` में दी गई सूची से करता है, और `values` खाली आती है; इसलिए जब तक आप अपनी स्तर-सूची कॉन्फ़िगर नहीं करते, यह नियम चुपचाप पास होने के बजाय बताता है कि वह चल नहीं सका। यह केवल देखता है कि मान आपकी सूची में है — किसी घटना पर कौन-सा स्तर लागू होना चाहिए, यह कभी नहीं तय करता। |
+| केवल सूचना देने वाले चरण में कोई उपकरण नहीं गिनाया गया। क्या यह दर्ज होता है? | नहीं। `DR-004` `resource` कॉलम की अपेक्षा केवल तब करता है जब उस चरण की `script` सामग्री भरी हो, इसलिए सूचना-मात्र चरण से संसाधन नहीं माँगे जाते। यह देखता है कि संसाधन गिनाए गए हैं, यह नहीं कि वे पर्याप्त हैं या मौके पर उपलब्ध साजो-सामान से मेल खाते हैं। |
+| चरणों की अवधियों का जोड़ अभ्यास की नियोजित अवधि से मेल नहीं खाता। क्या यह पकड़ में आता है? | हाँ। `DR-005` चरणों के `durationMin` मानों को जोड़कर उस जोड़ की तुलना `totalDurationMin` से करता है, जिसे वह सामग्री के हेडर से लेता है — पहले पंक्ति के भीतर खोजता है, फिर हेडर पर लौट आता है। यह केवल जोड़ की जाँच है: समय-विभाजन तर्कसंगत है या पर्याप्त, यह नहीं आँकता। |
+| किसी चरण के मुख्य-बिंदु कॉलम में क्या लिखा होना चाहिए? | `DR-006` अपेक्षा करता है कि चरण का `checkpoint` कॉलम — मुख्य बिंदु और उसकी निर्णय-शर्त — भरा हो। यह देखता है कि वहाँ कुछ लिखा गया है, यह नहीं कि शर्त देखने योग्य या उपयुक्त है। |
+| एक ही चरण तीन क्रिया-पंक्तियों में बँटा है और उनमें से दो पर एक ही चरण-क्रमांक है। | `DR-007` दोहराया गया `stepNo` दर्ज करता है, क्योंकि दोहराव से अवधियों का जोड़ और चरणों की गिनती अविश्वसनीय हो जाती है। एक ही चरण का कई क्रिया-पंक्तियों में बँटना सामान्य है — हर पंक्ति को अपना अलग चरण-क्रमांक दें। |
+
+## यह किन मानकों पर आधारित है
+
+| दस्तावेज़ | संख्यांक | इन्हें उद्धृत करने वाले नियम |
+|---|---|---|
+| 《生产安全事故应急演练基本规范》 | YJ/T 9007—2019（原 AQ/T 9007—2019，2025 年第 1 号公告调整代号；本次未取得条文） | DR-001, DR-002, DR-004, DR-005, DR-006, DR-007, DR-008 |
+| 本单位应急预案体系（本机构配置） | 无统一标准（本条依据为本机构预案的分级口径） | DR-003 |
 
 **Boundary:** this plugin checks an **应急演练脚本** for completeness and arithmetic — that each step names its
 phase and script content, that it names a commander, that the response level comes from your vocabulary, that a

package/README-pt.md

@@ -1,4 +1,24 @@
-# dsh-drill-script-check
+# dsh-drill-script-check — Verificação da completude e da aritmética de um guião de simulacro de emergência
+
+`dsh-drill-script-check` lê um guião de simulacro de emergência —o cabeçalho do simulacro mais uma linha por etapa— e verifica a completude e a aritmética desse guião: se cada etapa regista a sua fase de simulacro ou o seu conteúdo de guião, se nomeia um responsável de comando, se o nível de resposta vem do vocabulário que configura, se uma etapa com ação de guião enumera os recursos de que necessita, se as durações das etapas somam a duração prevista do simulacro, se um ponto crítico declara a sua condição de julgamento, se não há números de etapa repetidos e se o cabeçalho nomeia o simulacro e a entidade organizadora.
+
+## O que ele responde
+
+| Você pergunta | O que ele responde |
+|---|---|
+| Uma etapa não tem preenchidas nem a fase do simulacro nem o conteúdo do guião. Isso é reportado? | Sim. `DR-001` pede em conjunto as colunas `phase` e `script` e reporta a etapa em que nenhuma das duas está preenchida — basta uma delas para passar. Verifica que a coluna está preenchida, não se a ação está correta ou conforme ao seu plano de emergência. |
+| Preenchi o nível de resposta, mas `DR-003` reporta-se em `skipped`. Porquê? | `DR-003` compara a coluna `level` com o vocabulário de `values`, que vem vazio, por isso, até configurar os seus próprios níveis, a regra reporta que não pôde ser executada em vez de passar em silêncio. Só verifica que o valor consta da sua lista: nunca julga que nível um evento deveria desencadear. |
+| Uma etapa meramente informativa não enumera equipamento. Isso é assinalado? | Não. `DR-004` pede a coluna `resource` apenas quando o conteúdo `script` dessa etapa está preenchido, pelo que a uma etapa informativa não se pedem meios. Verifica que os recursos estão enumerados, não que sejam suficientes ou que correspondam ao que existe no local. |
+| As durações das etapas não somam a duração prevista do simulacro. Isso é detetado? | Sim. `DR-005` soma os valores de `durationMin` das etapas e compara esse total com `totalDurationMin`, que toma do cabeçalho do material: procura primeiro dentro da linha e recorre ao cabeçalho. É apenas uma verificação de soma: não julga se a distribuição do tempo é razoável ou suficiente. |
+| O que deve conter a coluna de ponto crítico de uma etapa? | `DR-006` exige que a coluna `checkpoint` —o ponto crítico com a sua condição de julgamento— esteja preenchida na etapa. Verifica que algo foi aí escrito, não que a condição seja observável ou adequada. |
+| Uma fase reparte-se por três linhas de ação e duas delas levam o mesmo número de etapa. | `DR-007` reporta o `stepNo` repetido, porque a repetição torna pouco fiáveis o total das durações e a contagem das etapas. Repartir uma fase por várias linhas de ação é normal: dê a cada linha o seu próprio número de etapa. |
+
+## Normas que segue
+
+| Documento | Número | Regras que o citam |
+|---|---|---|
+| 《生产安全事故应急演练基本规范》 | YJ/T 9007—2019（原 AQ/T 9007—2019，2025 年第 1 号公告调整代号；本次未取得条文） | DR-001, DR-002, DR-004, DR-005, DR-006, DR-007, DR-008 |
+| 本单位应急预案体系（本机构配置） | 无统一标准（本条依据为本机构预案的分级口径） | DR-003 |
 
 **Boundary:** this plugin checks an **应急演练脚本** for completeness and arithmetic — that each step names its
 phase and script content, that it names a commander, that the response level comes from your vocabulary, that a

package/README-zh.md

@@ -1,4 +1,24 @@
-# dsh-drill-script-check
+# dsh-drill-script-check — 应急演练脚本核对
+
+`dsh-drill-script-check` 读取一份应急演练脚本——演练表头加每个环节一行——核对这份脚本自身的齐备与算术：每个环节是否填写演练阶段或脚本内容、是否明确指挥人、响应级别是否取自你配置的口径、有脚本动作的环节是否列明所需资源、各环节计划时长合计是否等于演练总时长、关键节点是否写明判定条件、环节序号是否重复、表头是否声明演练名称与组织单位。
+
+## 它回答什么问题
+
+| 你会问 | 它怎么答 |
+|---|---|
+| 某个环节的演练阶段和脚本内容都没填，会被报出吗？ | 会。`DR-001` 同时要求 `phase` 与 `script` 两栏，两栏都空才报出该行——填了其中一栏即通过。它只核对这一栏是否填写，不判断该处置动作是否正确、是否符合预案。 |
+| 我填了响应级别，`DR-003` 却报告 `skipped`，为什么？ | `DR-003` 拿 `level` 栏与 `values` 里的取值清单比对，而 `values` 出厂为空，因此在你配置本单位的分级口径之前，本条报告 `skipped`（无法执行），而不是静默通过。它只核对所填值是否在册，绝不判断某一事件应当启动哪一级响应。 |
+| 纯告知性的环节没有列装备物资，会被报出吗？ | 不会。`DR-004` 只在环节的 `script` 内容已填写时才要求 `resource` 栏，因此纯告知性的环节不会被要求列资源。它只核对资源栏是否填写，不判断所列资源是否充足、是否与实际配备一致。 |
+| 各环节计划时长加起来不等于演练总时长，能查出来吗？ | 能。`DR-005` 把各环节的 `durationMin` 相加，再与 `totalDurationMin` 相比，后者取自材料表头（引擎会先在行内找，再回落到表头）。本条只做加法核对，不判断时间安排是否合理、是否够用。 |
+| 环节的关键节点栏要写什么？ | `DR-006` 要求该环节的 `checkpoint` 栏填写关键节点及其判定条件。它只核对这一栏是否写明，不判断该条件是否可观测、是否恰当。 |
+| 同一阶段分了三个动作行，其中两行的环节序号相同。 | `DR-007` 会报出重复的 `stepNo`，因为序号重复会让时长合计与环节统计失真。同一阶段分多个动作各占一行是正常的——给每行各自的序号即可。 |
+
+## 依据的标准
+
+| 文件 | 文号 | 引用它的规则 |
+|---|---|---|
+| 《生产安全事故应急演练基本规范》 | YJ/T 9007—2019（原 AQ/T 9007—2019，2025 年第 1 号公告调整代号；本次未取得条文） | DR-001, DR-002, DR-004, DR-005, DR-006, DR-007, DR-008 |
+| 本单位应急预案体系（本机构配置） | 无统一标准（本条依据为本机构预案的分级口径） | DR-003 |
 
 **Boundary:** this plugin checks an **应急演练脚本** for completeness and arithmetic — that each step names its
 phase and script content, that it names a commander, that the response level comes from your vocabulary, that a

package/README.md

@@ -1,4 +1,24 @@
-# dsh-drill-script-check
+# dsh-drill-script-check — Emergency drill script completeness and arithmetic check
+
+`dsh-drill-script-check` reads one emergency drill script — the drill header plus one row per step — and checks that script's own completeness and arithmetic: that each step records its drill phase or its script content, that it names a commander, that the response level comes from the vocabulary you configure, that a step with a script action lists the resources it needs, that the step durations total the drill's planned duration, that a key checkpoint states its judgement condition, that no step number is repeated, and that the header names the drill and the organising unit.
+
+## What it answers
+
+| You ask | What it answers |
+|---|---|
+| A step has neither its drill phase nor its script content filled in. Is that reported? | Yes. `DR-001` asks for the `phase` and `script` columns together and reports the step where neither of the two is filled — one of them is enough to pass. It checks that the column is filled, not whether the action is correct or matches your emergency plan. |
+| I filled in the response level, but `DR-003` reports itself in `skipped`. Why? | `DR-003` compares the `level` column with the vocabulary in `values`, which ships empty, so until you configure your own levels the rule reports that it could not run instead of passing silently. It only checks that the value is one of yours — it never judges which level an event should trigger. |
+| A step that is purely informational lists no equipment. Is that flagged? | No. `DR-004` asks for the `resource` column only when that step's `script` content is filled, so an informational step is not asked for equipment. It checks that the resources are listed, not that they are sufficient or that they match what is actually on site. |
+| The step durations do not add up to the drill's planned duration. Will the check catch it? | Yes. `DR-005` adds the `durationMin` values of the steps and compares that total with `totalDurationMin`, which it takes from the header of the material — it looks inside the row first and falls back to the header. It is an addition check only: it does not judge whether the time arrangement is reasonable or sufficient. |
+| What must the checkpoint column of a step contain? | `DR-006` requires the `checkpoint` column — the key node together with its judgement condition — to be filled on the step. It checks that something has been written there, not that the condition is observable or appropriate. |
+| One phase is split over three action rows and two of them carry the same step number. | `DR-007` reports the repeated `stepNo`, because a repeat makes the duration total and the step count unreliable. Splitting one phase into several action rows is normal — give each row its own step number. |
+
+## Standards it follows
+
+| Document | Number | Cited by rules |
+|---|---|---|
+| 《生产安全事故应急演练基本规范》 | YJ/T 9007—2019（原 AQ/T 9007—2019，2025 年第 1 号公告调整代号；本次未取得条文） | DR-001, DR-002, DR-004, DR-005, DR-006, DR-007, DR-008 |
+| 本单位应急预案体系（本机构配置） | 无统一标准（本条依据为本机构预案的分级口径） | DR-003 |
 
 **Boundary:** this plugin checks an **应急演练脚本** for completeness and arithmetic — that each step names its
 phase and script content, that it names a commander, that the response level comes from your vocabulary, that a

package/SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security vulnerabilities **privately** through GitHub's private
+vulnerability reporting:
+
+**Security → Report a vulnerability** at
+https://github.com/PerryLink/dsh-drill-script-check/security/advisories/new
+
+Do **not** open a public issue for security findings.
+
+Before reporting, **sanitize everything you paste**: remove tokens, API keys,
+credentials, authorization headers, session contents, and personal data. Logs
+without secrets only.
+
+## Scope note
+
+This plugin is an offline checker. It reads the material you hand it and
+compares it against a versioned rule pack; it makes no network calls and no
+model calls, and it stores nothing.
+
+## What to include
+
+- affected package version (and DeepSeek Harness runtime version)
+- a minimal reproduction
+- your impact assessment
+
+## Response expectations
+
+- acknowledgement within **7 days**
+- status updates at least every **14 days** until resolution
+- coordinated disclosure: the fix and advisory are prepared first; the finding
+  is disclosed publicly after the fix ships
+
+## Credits and disclosure
+
+- reporters are credited in the advisory and CHANGELOG unless they ask to stay anonymous
+- advisories follow GitHub's advisory workflow and are published together with the fix

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-drill-script-check",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "应急演练脚本核对（按阶段、响应分级、指挥与资源要素核对脚本齐备，仅提示差异，不作出定性结论）",
   "type": "module",
   "main": "lib/index.mjs",
@@ -23,7 +23,9 @@
     "README-hi.md",
     "locale/*.json",
     "icon.svg",
-    "rules"
+    "rules",
+    "CHANGELOG.md",
+    "SECURITY.md"
   ],
   "scripts": {
     "build": "tsdown",
@@ -32,7 +34,7 @@
     "verify:self-contained": "node scripts/verify-self-contained.mjs",
     "check:lockfile": "node scripts/check-lockfile-drift.mjs",
     "check:readmes": "node scripts/check-readme-sync.mjs",
-    "prepublishOnly": "pnpm run typecheck && pnpm test && pnpm run build && pnpm run verify:self-contained && pnpm run check:readmes && pnpm run check:citations",
+    "prepublishOnly": "pnpm run typecheck && pnpm test && pnpm run build && pnpm run verify:self-contained && pnpm run check:lockfile && pnpm run check:readmes && pnpm run check:citations",
     "prepare": "tsdown",
     "check:citations": "node scripts/check-citations.mjs"
   },